This document provides a taxonomy, reference model, considerations for a security framework and a security problem definition for digital currency hardware wallets (DCHWs). It also specifies security objectives to address security issues related to the security problem definition. This document is applicable to organizations that develop and operate DCHWs, e.g. mobile device manufacturers, chip manufacturers and companies that provide DCHW solutions. This document is also relevant to third parties that provide services to these stakeholders. It addresses sovereign or fiat digital currencies issued by a specific entity, e.g. a central bank.

  • Standard
    35 pages
    English language
    sale 15% off

This document defines a method for packaging cryptographic keys for transport. This method can also be used for the storage of keys under an advanced encryption standard (AES) key. The method uses the block cipher AES as the wrapping cipher algorithm. Other methods for wrapping keys are outside the scope of this document but can use the authenticated encryption algorithms specified in ISO/IEC 19772.

  • Standard
    92 pages
    English language
    sale 15% off

This document provides a specification for QR codes for mobile (instant) credit transfers (MCTs) whereby the payer uses a mobile device to initiate the payment transaction. The QR code is used to exchange data between the payer and the payee to enable the initiation of the (instant) credit transfer by the payer.
This document is applicable to both cases where the QR code is presented by the payee or by the payer.
This document excludes the following from its scope:
—   The details of technical requirements and the supporting infrastructure to achieve interoperability amongst mobile (instant) credit transfer (MCT) service providers;
—   The detailed implementation specification of the payload included in the QR code.

  • Standard
    36 pages
    English language
    e-Library read for
    ×1 day

This document provides a specification for QR codes for mobile (instant) credit transfers (MCTs) whereby the payer uses a mobile device to initiate the payment transaction. The QR code is used to exchange data between the payer and the payee to enable the initiation of the (instant) credit transfer by the payer.
This document is applicable to both cases where the QR code is presented by the payee or by the payer.
This document excludes the following from its scope:
—   The details of technical requirements and the supporting infrastructure to achieve interoperability amongst mobile (instant) credit transfer (MCT) service providers;
—   The detailed implementation specification of the payload included in the QR code.

  • Standard
    36 pages
    English language
    e-Library read for
    ×1 day

This document provides a list of recommended ISO cryptographic algorithms for use within applicable ISO TC 68, Financial services, standards. It also provides strategic guidance on key lengths and associated parameters and usage dates. This document focuses on core algorithms, key lengths and frequently used mechanisms. The included algorithms are considered to be fit for purpose for financial service use. For additional algorithms, see the body of standards produced by ISO/IEC JTC 1 SC 27, Information security, cybersecurity and privacy protection. For standards on key management, see ISO 11568. The categories of algorithms covered are: a) block ciphers and modes of operation; b) stream ciphers; c) message authentication codes (MACs); d) authenticated encryption algorithms; e) format preserving encryption; f) hash functions; g) asymmetric algorithms: 1) digital signature schemes giving message recovery; 2) digital signatures with appendix; 3) asymmetric ciphers. h) authentication mechanisms; i) key derivation, establishment and agreement mechanisms; j) key transport mechanisms: 1) key wrapping. This document does not define any cryptographic algorithms. However, the standards to which this document refers contain necessary implementation information as well as more detailed guidance regarding choice of security parameters, security analysis and other implementation considerations.

  • Technical specification
    36 pages
    English language
    sale 15% off

This document specifies cryptographic methods for: — PIN generation; — reference PIN change; — transaction PIN verification. These PIN management functions can be implemented using: — encryption using an approved algorithm (see REF Table_tab_1 \r \h Table 1 08D0C9EA79F9BACE118C8200AA004BA90B02000000080000000C0000005400610062006C0065005F007400610062005F0031000000 ); — CMAC using an approved block cipher (see REF Table_tab_1 \r \h Table 1 08D0C9EA79F9BACE118C8200AA004BA90B02000000080000000C0000005400610062006C0065005F007400610062005F0031000000 ); — HMAC using an approved hash algorithm (see REF Table_tab_1 \r \h Table 1 08D0C9EA79F9BACE118C8200AA004BA90B02000000080000000C0000005400610062006C0065005F007400610062005F0031000000 ). Refer to ISO 9564-1 for basic principles & requirements regarding PIN establishment.

  • Standard
    21 pages
    English language
    sale 15% off

This document gives requirements and guidance on security controls and implementation for third-party payment service providers (TPPSPs). This document deals with the overall security controls of TPPSPs from developing and testing to installing, operating and auditing the system. These security controls consist of: — security governance controls; — cross-functional controls; — function-specific controls.

  • Standard
    24 pages
    English language
    sale 15% off

This document specifies approved algorithms for the encipherment of personal identification numbers (PINs).

  • Standard
    13 pages
    English language
    sale 15% off

This document defines fundamental terminology for blockchain and distributed ledger technologies.

  • Standard
    22 pages
    English language
    e-Library read for
    ×1 day

This document defines fundamental terminology for blockchain and distributed ledger technologies.

  • Standard
    22 pages
    English language
    e-Library read for
    ×1 day

This document provides the normative specification of Simple Binary Encoding (SBE), which is one of the possible syntaxes for FIX messages, but not limited to FIX messages. The scope comprises the encoding (wire format) and the message schema for SBE.

  • Standard
    55 pages
    English language
    sale 15% off

This document is concerned with the representation of the ISO 20022 e-Repository contents in RDF and OWL by developing a case study around the ISO 20022 auth.016 sample message (hereafter simply referred to as “auth.016”). This includes: a) transformation of the sample message into an RDF instance graph; b) demonstrating a set of SPARQL rules that transform the auth.016 message into a FIX TradeCaptureReport(35=AE) message (hereafter simply referred to as “FIX AE”); c) expressing the metamodel, business components and message components exactly with a custom RDF vocabulary; d) representing those schemas as OWL schemas using OWL vocabulary when possible and annotation properties otherwise; e) creating instance graphs for the auth.016 sample messaging using the vocabulary of the business components and message components. This document also discusses the choices that arise in structuring RDF documents equivalent to documents in XML, and FIX Tag-Value format balancing considerations such as preserving the order of parts of the message versus creating graphs that are suitable for RDFS and OWL inference.

  • Technical report
    45 pages
    English language
    sale 15% off

This document provides guidelines for a security framework to address the implementation of security mechanisms in technical infrastructures designed for the provision of third-party payment (TPP) services in order to achieve the security objectives defined in ISO 23195. The security framework is intended to protect critical systems and objects within the TPP system environment, either under the direct control of the third-party payment service provider (TPPSP) or by another entity (e.g. a bank). This document is applicable to the provision of any TPP service, including: — the TPP logical structural model; — the definition of the security framework; — the design principles, responsibilities and functional recommendations to support the security mechanism; — guidelines for applying the security framework defined in this document.

  • Technical specification
    24 pages
    English language
    sale 15% off

This document provides guidelines on privacy for fintech services. It identifies all relevant business models and roles in consumer-to-business relations and business-to-business relations, as well as privacy risks and privacy requirements, which are related to fintech services. It provides specific privacy controls for fintech services to address privacy risks. This document is based on the principles from ISO/IEC 29100, ISO/IEC 27701, and ISO/IEC 29184, the privacy impact assessment framework described in ISO/IEC 29134, and the risk management guideline described in ISO 31000. It also provides guidelines focusing on a set of privacy requirements for each stakeholder. This document can be applicable to all kinds of organizations such as regulators, institutions, service providers and product providers in the fintech service environment.

  • Standard
    30 pages
    English language
    sale 15% off

Common security requirements for internet connected radio equipment that equipment enables the holder or user to transfer money, monetary value or virtual currency. This document provides technical specifications for radio equipment processing virtual money or monetary value, which apply to electrical or electronic products that are capable to communicate over the internet, regardless of whether these products communicate directly or via any other equipment.

  • Standard
    185 pages
    English language
    e-Library read for
    ×1 day

Common security requirements for internet connected radio equipment that equipment enables the holder or user to transfer money, monetary value or virtual currency. This document provides technical specifications for radio equipment processing virtual money or monetary value, which apply to electrical or electronic products that are capable to communicate over the internet, regardless of whether these products communicate directly or via any other equipment.

  • Standard
    185 pages
    English language
    e-Library read for
    ×1 day

This document specifies the security characteristics for secure cryptographic devices (SCDs) based on the cryptographic processes defined in the ISO 9564 series, ISO 16609 and ISO 11568. This document states the security characteristics concerning both the operational characteristics of SCDs and the management of such devices throughout all stages of their life cycle. This document does not address issues arising from the denial of service of an SCD. This document does not address software services that use multi-party computation (MPC) to achieve some security objectives and, relying on these, offer cryptographic services. NOTE These are sometimes called “soft” or software hardware security modules (HSMs) in common language, which is misleading and does not correspond to the definition of HSM in this document.

  • Standard
    27 pages
    English language
    sale 15% off

This document provides an overview, risk assessment, minimum security requirements and extended security guidelines for code-scanning payment in which the payer uses a mobile device to operate the payment transaction. This document is applicable to cases where the payment code is used to initiate a mobile payment and presented by either the payer or the payee. The following is excluded from the scope of this document: — details of payer and payee onboarding; — details of the supporting payment infrastructure, as described in 5.1.

  • Standard
    30 pages
    English language
    sale 15% off

This document defines fundamental terminology for blockchain and distributed ledger technologies.

  • Standard
    14 pages
    English language
    sale 15% off
  • Standard
    13 pages
    French language
    sale 15% off
  • Standard
    13 pages
    French language
    sale 15% off

This document specifies an acceptable security framework for the issuance and management of digital currencies using cryptographic mechanisms standardized by ISO/TC 68/SC 2 and other references. This document proposes a framework approach based on standards for mitigating vulnerabilities for digital currency systems. The objective is that security aspects are integrated by design and not added afterwards as an extra processing layer that needs to accommodate legacy infrastructures.

  • Technical specification
    14 pages
    English language
    sale 15% off

This document provides an overview of identifiers [and their standards and register(s)] relevant for the design of blockchain systems and the interoperability of those systems with non-blockchain systems. The following criteria were used for inclusion of identifiers in this document: — Identifiers (and their standards and registers) issued by the public sector for subjects and objects such as citizen numbers, business registration numbers or land registration numbers; — Identifiers that are internationally recognized and fulfil one of the following criteria: — An identifier is an international standard of an SDO (Standard Development Organization); — An identifier is a de facto standard according to the norms of the industry involved (even if it is not an international standard of an SDO). — Identifiers that have relevance for DLT systems as it fulfils one of the following criteria: — An identifier that has been used without DLT, but has proven to solve the problems of DLT services using DLT; — An identifier that was designed with the usage of DLT in mind from the beginning.

  • Technical report
    50 pages
    English language
    sale 15% off

This document describes concepts and considerations on the use of trust anchors for systems leveraging blockchain and distributed ledger technologies (DLTs) for identity management, i.e. the mechanism by which one or more entities can create, be given, modify, use and revoke a set of identity attributes.

  • Technical report
    25 pages
    English language
    sale 15% off

This document describes the management of cryptographic keys in a blockchain, or distributed system used in the financial sector The objective of this document is to consider the impact of different types of key management processes that are required for PKI implementations in Blockchain and DLT projects

  • Technical report
    18 pages
    English language
    sale 15% off

This document specifies the security framework for using biometrics for authentication of customers in financial services, focusing exclusively on retail payments. It introduces the most common types of biometric technologies and addresses issues concerning their application. This document also describes representative architectures for the implementation of biometric authentication and associated minimum control objectives. The following are within the scope of this document: — use of biometrics for the purpose of: — verification of a claimed identity; — identification of an individual; — biometric authentication threats, vulnerabilities and controls; — validation of credentials presented at enrolment to support authentication; — management of biometric information across its life cycle, comprising enrolment, transmission and storage, verification, identification and termination processes; — security requirements for hardware used in conjunction with biometric capture and biometric data processing; — biometric authentication architectures and associated security requirements. The following are not within the scope of this document: — detailed specifications for data collection, feature extraction and comparison of biometric data and the biometric decision-making process; — use of biometric technology for non-financial transaction applications, such as physical or logical system access control.

  • Standard
    65 pages
    English language
    sale 15% off

This document describes the management of symmetric and asymmetric cryptographic keys that can be used to protect sensitive information in financial services related to retail payments. The document covers all aspects of retail financial services, including connections between a card-accepting device and an Acquirer, between an Acquirer and a card Issuer, and between an ICC and a card-accepting device. It covers all phases of the key life cycle, including the generation, distribution, utilization, archiving, replacement and destruction of the keying material. This document covers manual and automated management of keying material, and any combination thereof, used for retail financial services. It includes guidance and requirements related to key separation, substitution prevention, identification, synchronization, integrity, confidentiality and compromise, as well as logging and auditing of key management events. Requirements associated with hardware used to manage keys have also been included in this document.

  • Standard
    115 pages
    English language
    sale 15% off

This specification describes the functionality of the services provided by the Depository (DEP) services under XFS, by defining the service-specific commands that can be issued, using the WFSGetInfo, WFSAsyncGetInfo, WFSExecute and WFSAsyncExecute functions.
A Depository is used for the acceptance and deposit of media into the device or terminal. There are two main types of depository: an envelope depository for the deposit of media in envelopes and a night safe depository for the deposit of bags containing bulk media.
An envelope depository accepts media, prints on the media and deposits the media into a holding container or bin. Some envelope depositories offer the capability to dispense an envelope to the customer at the start of a transaction. The customer takes this envelope, fills in the deposit media, possibly inscribes it and puts it into the deposit slot. The envelope is then accepted, printed and transported into a deposit container.
The envelope dispense mechanism may be part of the envelope depository device mechanism with the same entry/exit slot or it may be a separate mechanism with separate entry/exit slot.
Envelopes dispensed and not taken by the customer can be retracted back into the device. When the dispenser is a separate mechanism the envelope is retracted back into the dispenser container. When the dispenser is a common mechanism the envelope is retracted into the depository container.
A night safe depository normally only logs the deposit of a bag and does not print on the media.

  • Technical report
    47 pages
    English language
    e-Library read for
    ×1 day

This document examines semantic enrichment to support the maintenance of the ISO 20022 conceptual model. It reports on existing and proposed practices to enrich a model: — in a repository, annotating repository concepts with metadata using semantic markup or constraints; — outside a repository, using references to repository concepts, such as the provenance of changes.

  • Technical report
    12 pages
    English language
    sale 15% off

This specification describes the functions provided by a generic card embossing unit (CEU). These descriptions include definitions of the service-specific commands that can be issued, using the WFSAsyncExecute, WFSExecute, WFSGetInfo and WFSAsyncGetInfo functions.
Embossing card units are generally viewed by XFS as compound devices with the following capabilities and features:
•   Embossing or printing of magnetic stripe card/ smart card.
•   Reading/encoding magnetic stripe tracks 1, 2, and 3.
•   Reading/writing smart card.
•   LCD display/ keypad input.
The XFS services supporting the various embossing card unit components are outlined as follows:
•   Embossing or printing of magnetic stripe card/ smart card - Card Embossing Unit (CEU) service.
•   Reading/encoding magnetic stripe tracks 1, 2, and 3 - ID Card (IDC) service, however when combined encoding/ embossing is performed the CEU service class is used.
•   Reading/writing smart cards - ID Card (IDC) service, however when combined writing smart card/ embossing is performed the CEU service class is used.
•   LCD display/ keypad input - Text Terminal Unit (TTU) service.

  • Technical report
    55 pages
    English language
    e-Library read for
    ×1 day

This specification describes the functionality of a Barcode Reader (BCR) Service Provider. It defines the service-specific commands that can be issued to the Service Provider using the WFSGetInfo, WFSAsyncGetInfo, WFSExecute and WFSAsyncExecute functions.
Persistent values are maintained through power failures, open sessions, close session and system resets.
This extension to XFS specifications defines the functionality of BCR service.
A Barcode Reader scans barcodes using any scanning technology. The device logic converts light signals or image recognition into application data and transmits it to the host system.
The basic operation of the Barcode Reader is managed using WFSExecute/WFSAsyncExecute functions.
When an application wants to read a barcode, it issues a WFS_CMD_BCR_READ command to prepare the scanner to read any barcode presented to it. When a document is presented to the BCR and a barcode type is recognized, a completion event is received which contains the barcode data that has been read.

  • Technical report
    29 pages
    English language
    e-Library read for
    ×1 day

This specification describes the functionality of an XFS compliant Cash Dispenser Module (CDM) Service Provider. It defines the service-specific commands that can be issued to the Service Provider using the WFSGetInfo, WFSAsyncGetInfo, WFSExecute and WFSAsyncExecute functions.
Persistent values are maintained through power failures, open sessions, close session and system resets.
This specification covers the dispensing of items. An “item” is defined as any media that can be dispensed and includes coupons, documents, bills and coins. However, if coins and bills are both to be dispensed separate Service Providers must be implemented for each.
All currency parameters in this specification are expressed as a quantity of minimum dispense units, as defined in the description of the WFS_INF_CDM_CURRENCY_EXP command.
There are two types of CDM: Self-Service CDM and Teller CDM. A Self-Service CDM operates in an automated environment, while a Teller CDM has an operator present. The functionality provided by the following commands is only applicable to a Teller CDM:
WFS_CMD_CDM_SET_TELLER_INFO
WFS_INF_CDM_TELLER_INFO
It is possible for the CDM to be part of a compound device with the Cash-In Module (CIM). This CIM\CDM combination is referred to throughout this specification as a “Cash Recycler”. For details of the CIM interface see [Ref. 3].
If the device is a Cash Recycler then, if cash unit exchanges are required on both interfaces, the exchanges cannot be performed concurrently. An exchange on one interface must be complete (the WFS_CMD_CDM_END_EXCHANGE must have completed) before an exchange can start on the other interface. The WFS_ERR_CDM_EXCHANGEACTIVE error code will be returned if the correct sequence is not adhered to.
The CIM interface can be used for all exchange operations on recycle devices, and the CIM interface should be used if the device has recycle units of multiple currencies and/or denominations (including multiple note identifiers associated with the same denomination).

  • Technical report
    141 pages
    English language
    e-Library read for
    ×1 day

This specification describes the functionality of the services provided by the Sensors and Indicators Unit (SIU) services under WOSA/XFS, by defining the service-specific commands that can be issued, using the WFSGetInfo, WFSAsyncGetInfo, WFSExecute and WFSAsyncExecute functions.
This section describes the functions provided by a generic Sensors and Indicators Unit service. This service allows for the operation of the following categories of ports:
•   Door sensors, such as cabinet, safe or vandal shield doors.
•   Alarm sensors, such as tamper, seismic or heat sensors.
•   Generic sensors, such as proximity or ambient light sensors.
•   Key switch sensors, such as the ATM operator switch.
•   Lamp/sign indicators, such as fascia light or audio indicators.
Note that while the SIU device class provides some basic support for guidance lights, extended guidance light functionality is specified in the individual device class specifications.  Therefore it is recommended that device guidance lights be supported and controlled via the individual device classes.
•   Auxiliary indicators.
•   Enhanced Audio Controller, for use by the partially sighted.
In self-service devices, the sensors and indicators unit is capable of dealing with external sensors, such as door switches, locks, alarms and proximity sensors, as well as external indicators, such as turning on lamps or heating.

  • Technical report
    85 pages
    English language
    e-Library read for
    ×1 day

This specification describes the functionality of the services provided by the Card Dispenser (CRD) device class under XFS, by defining the service-specific commands that can be issued, using the WFSGetInfo, WFSAsyncGetInfo, WFSExecute and WFSAsyncExecute functions.
A Card Dispenser is used to dispense a single card to a consumer from one or more bins. Most card dispensers also have the ability to retain a card to a bin.

  • Technical report
    38 pages
    English language
    e-Library read for
    ×1 day

This specification describes the XFS service class for Item Processing Modules (IPM). The specification of this service class includes definitions of the service-specific commands that can be issued, using the WFSAsyncExecute, WFSExecute, WFSGetInfo and WFSAsyncGetInfo functions.
This service class is currently defined only for self service devices.
In the U.S., checks are always encoded in magnetic ink for reading by Magnetic Ink Character Recognition (MICR), and a single font is always used. In Europe some countries use MICR and some use Optical Character Recognition (OCR) character sets, with different fonts, for their checks.
Item Processing Modules accept one or more media items (Checks, Giros, etc.) and process these items according to application requirements. The IPM class supports devices that can handle a single item as well as those devices that can handle bunches of items. The following are the three principal device types:
• Single Item: can accept and process a single item at a time.
• Multi-Item Feed with no stacker (known as an escrow in some environments): can accept a bunch of media from the customer but each item has to be processed fully (i.e. deposited in a bin or returned) before the next item can be processed.
• Multi-Item Feed with a stacker: can accept a bunch of media from the customer and all items can be processed together.
The IPM class provides applications with an interface to control the following functions (depending on the capabilities of the specific underlying device):
• Capture an image of the front of an item in multiple formats and bit depths.
• Capture an image of the back of an item in multiple formats and bit depths.
• Read the code line of an item using MICR reader.
• Read the code line of an item using OCR.
• Endorse (print text) on an item.
• Stamp an item.
• Return an item to the customer.
• Deposit an item in a bin.
• Retract items left by the customer.
The IPM device class uses the concept of a Media-In transaction to track and control a customer’s interaction with the device. A Media-In transaction consists of one or more WFS_CMD_IPM_MEDIA_IN commands. The transaction is initiated by the first WFS_CMD_IPM_MEDIA_IN command and remains active until the transaction is either confirmed through WFS_CMD_IPM_MEDIA_IN_END, or terminated by WFS_CMD_IPM_MEDIA_IN_ROLLBACK, WFS_CMD_IPM_RETRACT_MEDIA or WFS_CMD_IPM_RESET. While a transaction is active the WFS_INF_IPM_TRANSACTION_STATUS command reports the status of the current transaction. When a transaction is not active the WFS_INF_IPM_TRANSACTION_STATUS command reports the status of the last transaction as well as some current status values.
There are primarily two types of devices supported by the IPM, those devices with a stacker and those without.
In this the specification the terms “long edge” and “short edge” are used to describe the orientation of a check and length of its edges. The diagram below illustrates these definitions.

  • Technical report
    125 pages
    English language
    e-Library read for
    ×1 day

This specification describes the XFS service class for Biometrics Device (BIO). The specification of this service class includes definitions of the service-specific commands.
Biometrics refers to metrics related to human characteristics and biology. Biometrics authentication can be used as a form of identification and/or access control. This is an overview of biometrics, as well as an introduction to the terminology used in this document. It introduces to XFS the concept of scanning a person’s biometric data in raw image form (raw biometric data), then processing it into a smaller more concise form that is easier to manage (biometric template data). The first scan of a user is called ENROLLMENT as the user is effectively being enrolled into a scheme by recording their biometric data. Thereafter subsequent scans of the user can be compared to the original data in order to verify who they say they are (VERIFICATION), or alternatively used to identify them as a specific individual (IDENTIFICATION).

  • Technical report
    55 pages
    English language
    e-Library read for
    ×1 day

Loading...